Designing Your Incident Severities

Not the author but written by my colleague Stephen, this is a short post on how to pick incident severities.

Lots of the literature around this is dense and intended for mega-corps, not your average growing company.

If you're ever unlucky enough to be building your company's incident response process, this is pragmatic "just do this and it'll be fine" advice, based on the experience of many companies doing a similar thing.

I remember once suggesting an incident severity calculation scheme based on assigning numerical values to managers (higher the level in the organisation then the higher the numerical value) and calculating a severity by adding up the values for the managers standing behind the unfortunate person actually working to resolve the incident. :-)

Edit: I think this was based on observation (from a safe distance) of a complete set of managers right up to the CIO standing behind the desk of someone in the helpdesk office.